Update knowledge.txt

knowledge.txt

@@ -0,0 +1,413 @@
+================================================================================
+SCAM DETECTION CHATBOT — KNOWLEDGE BASE
+Audience: General Consumers
+Version: 1.0
+================================================================================
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 1: UNIVERSAL RED FLAGS (Apply to ALL scam types)
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+These signals should raise suspicion regardless of the scam category:
+
+- URGENCY PRESSURE: Phrases like "Act now," "Limited time," "You must respond
+  within 24 hours," or "Your account will be suspended" are manipulation tactics
+  designed to prevent you from thinking critically.
+
+- REQUESTS FOR PERSONAL INFO: Legitimate organizations never ask for your Social
+  Security number, bank account details, passwords, or PINs via email or chat.
+
+- UNSOLICITED CONTACT: You did not initiate the conversation, yet they claim you
+  owe money, won a prize, or need to verify something.
+
+- TOO GOOD TO BE TRUE: Offers of large sums of money, guaranteed investment
+  returns, or high-paying jobs with little work are classic lures.
+
+- GRAMMATICAL ERRORS & AWKWARD PHRASING: Many scams originate overseas and
+  contain spelling mistakes, odd punctuation, or unnatural sentence structure.
+
+- REQUESTS FOR UNUSUAL PAYMENT: Gift cards, wire transfers, cryptocurrency, or
+  Zelle are preferred by scammers because transactions are hard to reverse.
+
+- SUSPICIOUS SENDER ADDRESS: The display name may look legitimate, but the
+  actual email domain is misspelled or unrelated (e.g., support@amaz0n-help.net).
+
+- LINKS THAT DON'T MATCH: Hovering over a link reveals a URL different from
+  what the text says (e.g., text says "PayPal.com" but link goes to paypa1.xyz).
+
+- SECRECY REQUESTS: "Don't tell your family," "This is confidential," or "Your
+  bank won't understand" are major warning signs.
+
+- IMPERSONATION OF AUTHORITY: Fake government agencies, banks, or well-known
+  companies are used to manufacture trust and fear.
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 2: SCAM TYPE — EMAIL PHISHING
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+WHAT IT IS:
+Phishing emails impersonate trusted brands (banks, Amazon, PayPal, Netflix,
+the IRS, Microsoft, etc.) to trick users into clicking malicious links or
+handing over login credentials and financial information.
+
+COMMON PATTERNS:
+- "Your account has been compromised. Verify now to avoid suspension."
+- "You have a package held at customs. Pay a small fee to release it."
+- "Unusual sign-in activity detected. Click here to secure your account."
+- "Your payment failed. Update your billing information immediately."
+- Fake invoice attachments (PDFs or Word docs containing malware).
+
+SPECIFIC RED FLAGS:
+- Sender domain doesn't match the company (e.g., paypal-service@gmail.com).
+- Email asks you to click a link and enter your username/password.
+- Greeting says "Dear Customer" or "Dear User" instead of your name.
+- Logo looks slightly off, blurry, or pixelated.
+- Link URL contains extra words or random characters (e.g., paypal.login-verify.com).
+- Email threatens account closure, legal action, or financial penalty.
+
+WHY IT'S DANGEROUS:
+Clicking the link leads to a fake website that captures your credentials.
+Attachments may install malware or ransomware on your device.
+
+CHATBOT WARNING TO USER:
+"This looks like a phishing email. Real companies will never ask for your
+password or payment details by email. Do not click any links or open
+attachments. Go directly to the company's official website by typing it
+yourself, or call their official customer service number."
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 3: SCAM TYPE — ROMANCE SCAMS
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+WHAT IT IS:
+A scammer creates a fake identity on dating sites, social media, or apps to
+build an emotional relationship with the victim over weeks or months, then
+fabricates a crisis requiring money.
+
+COMMON PROFILES USED:
+- Military personnel deployed overseas.
+- Doctors or engineers working on international projects.
+- Widowed professionals raising a child alone.
+- Attractive individuals with limited or inconsistent social media history.
+
+COMMON PATTERNS:
+- Moves very fast — declares love or deep connection unusually quickly.
+- Claims to be working abroad and cannot meet in person (yet).
+- Makes excuses for never being able to video call (camera broken, bad connection).
+- Eventually hits a crisis: medical emergency, legal trouble, stuck at customs,
+  needs money to return home.
+- Asks for wire transfer, gift cards, or crypto — never a traceable method.
+- After first payment, more "emergencies" follow.
+
+SPECIFIC RED FLAGS:
+- Profile photos are too polished (often stolen from models or military personnel).
+- Stories change or contain inconsistencies.
+- Asks to move communication off the dating platform to email or WhatsApp quickly.
+- Refuses or avoids video calls.
+- Asks for money, gift cards, or cryptocurrency.
+- Claims to love you but you have never met.
+
+WHY IT'S DANGEROUS:
+Victims can lose tens of thousands of dollars and suffer severe emotional harm.
+Scammers are often part of organized criminal groups.
+
+CHATBOT WARNING TO USER:
+"This has several signs of a romance scam. This person may not be who they
+claim to be. Never send money, gift cards, or cryptocurrency to someone you
+haven't met in person. Do a reverse image search on their photos at
+images.google.com. If you suspect a scam, report it to the FTC at
+reportfraud.ftc.gov."
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 4: SCAM TYPE — CRYPTO / INVESTMENT FRAUD
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+WHAT IT IS:
+Fraudulent investment schemes promise high or guaranteed returns through
+cryptocurrency, forex trading, stock tips, or fake investment platforms.
+"Pig butchering" scams combine romance and investment fraud.
+
+COMMON PATTERNS:
+- "I made $50,000 last month — I can show you how."
+- Fake trading platforms that show growing balances you can never actually withdraw.
+- Celebrity or influencer endorsements (almost always fabricated).
+- Initial small "test" withdrawals are allowed to build trust, then larger deposits
+  are locked or fees are demanded to release funds.
+- Promises of 10%, 20%, or higher guaranteed monthly returns.
+- Urgency to invest before a "limited window" closes.
+
+SPECIFIC RED FLAGS:
+- No verifiable company registration, license, or physical address.
+- Platform is not listed with FINRA, SEC, or a recognized regulatory body.
+- You were recruited via social media, dating app, or unsolicited message.
+- You must recruit others to earn more (Ponzi / MLM structure).
+- Withdrawal requests are blocked, delayed, or require additional "taxes" or "fees."
+- Returns are consistently too high regardless of market conditions.
+
+WHY IT'S DANGEROUS:
+Money sent to crypto addresses is nearly impossible to recover. These scams
+have cost victims billions of dollars globally.
+
+CHATBOT WARNING TO USER:
+"This shows signs of an investment scam. No legitimate investment guarantees
+high returns, and real platforms are registered with financial regulators.
+Do not send money or cryptocurrency. Verify any investment platform at
+investor.gov or finra.org/investors. If you've already sent money, contact
+your bank immediately and report to the FTC at reportfraud.ftc.gov."
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 5: SCAM TYPE — TECH SUPPORT SCAMS
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+WHAT IT IS:
+Scammers impersonate Microsoft, Apple, Google, or antivirus companies and
+claim your device has a virus or has been hacked, then charge for fake repairs
+or install actual malware via remote access tools.
+
+COMMON PATTERNS:
+- Pop-up alert on your screen: "Your computer is infected! Call 1-800-XXX-XXXX."
+- Unsolicited phone call claiming to be from Microsoft or Apple tech support.
+- Email saying your device sent suspicious activity and needs immediate attention.
+- Asks you to download remote access software (AnyDesk, TeamViewer, etc.).
+- Claims your bank account was accessed and asks you to verify by logging in
+  while they watch your screen.
+
+SPECIFIC RED FLAGS:
+- Microsoft, Apple, and Google do NOT proactively call customers about viruses.
+- Real security alerts from your OS do not include phone numbers to call.
+- Being asked to download software to give a stranger remote access to your computer.
+- Pressure to pay via gift cards, wire transfer, or cryptocurrency for "repairs."
+- Technician claims to find hundreds of "infections" and demands payment immediately.
+
+WHY IT'S DANGEROUS:
+Remote access allows scammers to steal files, install real malware, access
+banking apps, and drain accounts while you watch.
+
+CHATBOT WARNING TO USER:
+"This is a tech support scam. Microsoft, Apple, and Google will never
+contact you unsolicited about a virus. Do not call the number, do not
+download any software, and do not give anyone remote access to your computer.
+Close the pop-up by restarting your computer. Report it to the FTC at
+reportfraud.ftc.gov."
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 6: SCAM TYPE — FAKE JOB OFFER SCAMS
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+WHAT IT IS:
+Fake job listings or unsolicited job offers lure victims with easy, high-paying
+remote work. They either steal personal information, extract money upfront, or
+use the victim as an unwitting money mule.
+
+COMMON PATTERNS:
+- "Work from home, earn $500–$1,000/day liking social media posts."
+- "We found your resume online and want to hire you immediately — no interview needed."
+- Asks for your SSN, bank details, or ID for "payroll setup" before you start.
+- Sends you a check to buy equipment, then asks you to wire the remainder back
+  (the check later bounces, and you owe the bank).
+- Job involves receiving and forwarding packages or payments (money mule activity).
+
+SPECIFIC RED FLAGS:
+- Hired without a real interview (or interview via text/chat only).
+- Company is hard to verify — no real website, no LinkedIn presence, no reviews.
+- Salary is unusually high for vague or simple tasks.
+- Asked to pay for training, equipment, background checks, or certifications upfront.
+- Overpayment check scam: sent more than agreed and asked to return the difference.
+- Communication is exclusively via WhatsApp, Telegram, or personal email.
+
+WHY IT'S DANGEROUS:
+Victims lose money, have their identities stolen, or unknowingly commit federal
+crimes (money mule activity carries criminal liability).
+
+CHATBOT WARNING TO USER:
+"This has the hallmarks of a fake job scam. Legitimate employers never ask
+for payment upfront or send checks asking you to wire money back. Never share
+your SSN or bank information until you have verified the employer thoroughly.
+Search the company name plus the word 'scam' online. Report suspicious job
+offers to the FTC at reportfraud.ftc.gov or the FBI at ic3.gov."
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 7: SCAM TYPE — IRS / GOVERNMENT IMPERSONATION
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+WHAT IT IS:
+Scammers pose as IRS agents, Social Security Administration (SSA) officers,
+immigration officials, or law enforcement to intimidate victims into paying
+fake debts or fines immediately.
+
+COMMON PATTERNS:
+- "You owe back taxes. Pay immediately or face arrest."
+- "Your Social Security number has been suspended due to suspicious activity."
+- "There is a warrant out for your arrest. Pay to have it cleared."
+- Callers may spoof real government phone numbers to appear legitimate.
+- Pressure to pay via iTunes gift cards, Google Play cards, wire transfer, or crypto.
+
+SPECIFIC RED FLAGS:
+- The IRS NEVER calls demanding immediate payment without first mailing you a bill.
+- The IRS NEVER demands payment via gift cards, wire transfer, or cryptocurrency.
+- Government agencies do not threaten immediate arrest over the phone or email.
+- Caller refuses to send written documentation of the alleged debt.
+- Caller demands secrecy and instructs you not to tell family members.
+
+HOW THE REAL IRS WORKS:
+- The IRS contacts taxpayers primarily by mail.
+- You always have the right to appeal or question what you owe.
+- If you owe taxes, you can pay at IRS.gov directly.
+
+CHATBOT WARNING TO USER:
+"This is a government impersonation scam. The IRS and Social Security
+Administration do not demand immediate payment by phone, email, or gift cards.
+Hang up or do not respond. If you're worried about a real tax issue, go
+directly to IRS.gov or call 1-800-829-1040. Report this to the Treasury
+Inspector General at 1-800-366-4484 or the FTC at reportfraud.ftc.gov."
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 8: SCAM TYPE — PRIZE / LOTTERY SCAMS
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+WHAT IT IS:
+The victim is told they've won a lottery, sweepstakes, or prize but must pay
+fees, taxes, or processing charges upfront to claim it. No prize ever exists.
+
+COMMON PATTERNS:
+- "Congratulations! You've been selected to receive $500,000. Pay a $500
+  processing fee to claim your winnings."
+- Fake notifications mimicking Publishers Clearing House, national lotteries,
+  or foreign lotteries.
+- "You are the lucky winner of our Facebook giveaway — send us your address
+  and a small shipping fee."
+- A check is sent for "partial winnings" with instructions to deposit it and
+  wire back the taxes (check later bounces).
+
+SPECIFIC RED FLAGS:
+- You never entered the contest, lottery, or giveaway they reference.
+- You must pay money to receive money — this is the defining sign of a scam.
+- Winner notifications arrive via email, text, or social media instead of
+  certified mail (for legitimate sweepstakes).
+- Requests for your SSN or bank details to "deposit your winnings."
+- Urgency: "You must claim within 48 hours or the prize is forfeited."
+
+A KEY RULE:
+Legitimate lotteries and sweepstakes NEVER require winners to pay fees or
+taxes upfront. Any required taxes are deducted from the prize itself.
+
+CHATBOT WARNING TO USER:
+"This is a prize or lottery scam. You cannot win a contest you never entered,
+and real prizes never require upfront payment. Do not send any money or
+share your personal information. Delete or ignore this message. If you've
+already paid, contact your bank immediately and report the scam to the FTC
+at reportfraud.ftc.gov."
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 9: SCAM KEYWORD & PHRASE TRIGGER LIST
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+The following words and phrases, especially in combination, are strong
+indicators of a scam. Use these as detection triggers.
+
+HIGH-RISK PHRASES:
+- "Act immediately" / "Respond within 24 hours" / "Urgent action required"
+- "You have been selected" / "Congratulations, you've won"
+- "Your account has been compromised" / "Suspicious activity detected"
+- "Pay with gift cards" / "Buy iTunes cards" / "Send Bitcoin"
+- "Do not tell anyone" / "Keep this confidential"
+- "Send me your SSN" / "Wire the funds"
+- "Guaranteed returns" / "Risk-free investment"
+- "Your Social Security number has been suspended"
+- "Warrant for your arrest" / "Police are on their way"
+- "Click here to verify your account"
+- "You owe back taxes" / "Immediate payment required"
+- "I am deployed overseas" / "I am working on an oil rig"
+- "I need your help — I'm in trouble"
+- "Send a processing fee to claim your prize"
+- "Your computer has a virus — call this number"
+- "We found your resume and want to hire you"
+- "Deposit this check and send us back the difference"
+
+SUSPICIOUS PAYMENT METHOD MENTIONS:
+- Gift cards (iTunes, Google Play, Amazon, Steam, Target)
+- Wire transfer / Western Union / MoneyGram
+- Zelle (to strangers)
+- Bitcoin / Ethereum / Cryptocurrency
+- Cash App / Venmo (to strangers)
+
+SUSPICIOUS DOMAIN PATTERNS (for email sender analysis):
+- Misspelled brand names: amaz0n, paypa1, netf1ix, micros0ft
+- Hyphens in brand domains: amazon-support.com, apple-id-verify.net
+- Extra words added: paypal-billing-department.com
+- Free email providers for "official" contact: support@gmail.com, irs@yahoo.com
+- Country code domains for US companies: amazon.co.ru, apple.com.br.xyz
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 10: WHAT TO DO IF YOU SUSPECT OR HAVE BEEN SCAMMED
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+IF YOU HAVEN'T SENT MONEY OR INFORMATION YET:
+1. Do not respond, click links, or call any phone numbers in the message.
+2. Block the sender.
+3. Delete the message.
+4. If impersonating a real brand, forward the email to that company's abuse
+   team (e.g., phishing@paypal.com, reportphishing@apple.com).
+
+IF YOU HAVE ALREADY SENT MONEY:
+1. Contact your bank or credit card company immediately — ask about reversing
+   the transaction.
+2. If you sent a wire transfer, call your bank within 24 hours.
+3. If you paid with gift cards, contact the gift card company directly.
+4. If you sent cryptocurrency, contact the exchange if applicable.
+
+IF YOU SHARED PERSONAL INFORMATION:
+1. Change passwords for any accounts that may be affected.
+2. Place a fraud alert or credit freeze at the three major bureaus:
+   - Equifax: equifax.com | 1-800-525-4360
+   - Experian: experian.com | 1-888-397-3742
+   - TransUnion: transunion.com | 1-800-916-8800
+3. Monitor your credit report at annualcreditreport.com.
+
+WHERE TO REPORT SCAMS:
+- FTC (Federal Trade Commission): reportfraud.ftc.gov
+- FBI Internet Crime Complaint Center: ic3.gov
+- IRS impersonation scams: 1-800-366-4484
+- Social Security scams: oig.ssa.gov/report
+- Your state's attorney general office
+
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SECTION 11: CHATBOT RESPONSE TEMPLATES
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+Use these as base templates for chatbot responses when a scam is detected.
+
+--- TEMPLATE: HIGH CONFIDENCE SCAM DETECTED ---
+"⚠️ WARNING: This looks like a scam.
+
+[INSERT SCAM TYPE]-specific explanation of why this is suspicious.
+
+What you should do:
+• Do NOT click any links, call any numbers, or reply.
+• Do NOT send money, gift cards, or personal information.
+• [Insert relevant action, e.g., 'Contact your bank immediately' or 'Report to the FTC at reportfraud.ftc.gov.']
+
+You were right to check. Stay safe."
+
+--- TEMPLATE: POSSIBLE SCAM / SUSPICIOUS ---
+"🔶 CAUTION: This message has some warning signs.
+
+[Explain specific red flags detected.]
+
+Before taking any action:
+• Verify the sender by going directly to the official website — do not use
+  any links or phone numbers in the message.
+• When in doubt, do not respond.
+
+If you're unsure, it's always safer to ignore the message."
+
+--- TEMPLATE: LOOKS LEGITIMATE ---
+"✅ This message doesn't match common scam patterns, but always stay alert.
+
+Reminders:
+• Never share passwords or PINs — even with companies you trust.
+• If something feels off, trust your instincts and verify independently."
+
+================================================================================
+END OF KNOWLEDGE BASE
+================================================================================